1,500 high-severity CVEs disclosed in June 2026 after Claude Mythos Preview

Anthropic's April 2026 release of Claude Mythos Preview included claims of autonomous CVE discovery and exploitation. Project Glasswing partners including Microsoft, Google, Apple, and AWS integrated the model to scan and patch code. OpenAI launched a parallel Daybreak effort. These programs reported over 10,000 high- or critical-severity findings, with only a fraction individually disclosed through standard channels.

Epoch AI data records the June spike at 1,500 disclosures versus the previous peak of roughly 430. The increase aligns with the public availability of frontier models trained on large code corpora. Historical patterns show smaller disclosure surges after GPT-4 and Claude 3 releases, but none reached this scale. Model-assisted scanning accelerates both defensive patching and offensive reconnaissance by lowering the cost of identifying memory-safety and logic errors.

The correlation indicates that public deployment of autonomous discovery capabilities outpaces coordinated disclosure infrastructure. Organizations without equivalent model access face asymmetric exposure. Regulators tracking NVD and MITRE records will see sustained elevation unless vendors adopt synchronized embargo windows.

Operational response requires vendors to publish model-assisted scan coverage metrics alongside each release. Absent such metrics, downstream operators cannot calibrate patch velocity against accelerated discovery rates.